The Decisions request followed redirects with the Authorization header, so
a 302 carried the API key to the redirect target and its body was accepted
as the verdict. Refuse redirects like the AI Insights helper, cap the
response at 64 KiB, and bound the git probes with a 120s timeout (a timeout
now skips the gate instead of crashing it).